netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-rvg2-vh9m-cq32
GHSA-2x74-jrhg-mr4p
GHSA-3253-93gv-fv6c
GHSA-7246-m99m-q4pq
GHSA-8wjx-p2f8-5rjp
GHSA-9cxj-f8g7-43v7
GHSA-9rg4-33x9-wfrh
GHSA-9w73-mrh2-35pj
GHSA-j3jw-c3vp-jg36
GHSA-pc38-vvqw-jq9r
GHSA-q565-26vc-vpx8
GHSA-32h2-7245-4mh4
This commit is contained in:
advisory-database[bot]
2024-01-04 00:31:39 +00:00
parent dd31f27385
commit cca8a7d918
12 changed files with 113 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/04/GHSA-rvg2-vh9m-cq32/GHSA-rvg2-vh9m-cq32.json
+4
View File
@@ -52,6 +52,10 @@
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/01/03/6"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/01/03/7"
}
],
"database_specific": {
advisories/unreviewed/2023/12/GHSA-2x74-jrhg-mr4p/GHSA-2x74-jrhg-mr4p.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2x74-jrhg-mr4p",
"modified": "2023-12-25T09:30:21Z",
"modified": "2024-01-04T00:30:19Z",
"published": "2023-12-25T09:30:21Z",
"aliases": [
"CVE-2023-49954"
],
"details": "The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-25T08:15:07Z"
advisories/unreviewed/2023/12/GHSA-3253-93gv-fv6c/GHSA-3253-93gv-fv6c.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3253-93gv-fv6c",
"modified": "2023-12-25T09:30:21Z",
"modified": "2024-01-04T00:30:19Z",
"published": "2023-12-25T09:30:21Z",
"aliases": [
"CVE-2023-36485"
],
"details": "The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user via a malicious BPMN2 workflow definition file.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -35,7 +38,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-25T08:15:07Z"
advisories/unreviewed/2023/12/GHSA-7246-m99m-q4pq/GHSA-7246-m99m-q4pq.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7246-m99m-q4pq",
"modified": "2023-12-25T09:30:21Z",
"modified": "2024-01-04T00:30:20Z",
"published": "2023-12-25T09:30:21Z",
"aliases": [
"CVE-2023-38321"
],
"details": "OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference, daemon crash, and Captive Portal outage) via a GET request to /opennds_auth/ that lacks a custom query string parameter and client-token.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-25T09:15:07Z"
advisories/unreviewed/2023/12/GHSA-8wjx-p2f8-5rjp/GHSA-8wjx-p2f8-5rjp.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8wjx-p2f8-5rjp",
"modified": "2023-12-26T06:30:33Z",
"modified": "2024-01-04T00:30:20Z",
"published": "2023-12-26T06:30:33Z",
"aliases": [
"CVE-2023-27150"
],
"details": "openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-26T04:15:07Z"
advisories/unreviewed/2023/12/GHSA-9cxj-f8g7-43v7/GHSA-9cxj-f8g7-43v7.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9cxj-f8g7-43v7",
"modified": "2023-12-25T09:30:21Z",
"modified": "2024-01-04T00:30:19Z",
"published": "2023-12-25T09:30:21Z",
"aliases": [
"CVE-2023-31224"
],
"details": "There is broken access control during authentication in Jamf Pro Server before 10.46.1.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-25T08:15:07Z"
advisories/unreviewed/2023/12/GHSA-9rg4-33x9-wfrh/GHSA-9rg4-33x9-wfrh.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9rg4-33x9-wfrh",
"modified": "2023-12-25T09:30:21Z",
"modified": "2024-01-04T00:30:19Z",
"published": "2023-12-25T09:30:21Z",
"aliases": [
"CVE-2023-49944"
],
"details": "The Challenge Response feature of BeyondTrust Privilege Management for Windows (PMfW) before 2023-07-14 allows local administrators to bypass this feature by decrypting the shared key, or by locating the decrypted shared key in process memory. The threat is mitigated by the Agent Protection feature.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -31,7 +34,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-25T08:15:07Z"
advisories/unreviewed/2023/12/GHSA-9w73-mrh2-35pj/GHSA-9w73-mrh2-35pj.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9w73-mrh2-35pj",
"modified": "2023-12-25T09:30:21Z",
"modified": "2024-01-04T00:30:19Z",
"published": "2023-12-25T09:30:21Z",
"aliases": [
"CVE-2023-36486"
],
"details": "The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user by uploading a workflow definition file with a malicious filename.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -35,7 +38,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-25T08:15:07Z"
advisories/unreviewed/2023/12/GHSA-j3jw-c3vp-jg36/GHSA-j3jw-c3vp-jg36.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j3jw-c3vp-jg36",
"modified": "2023-12-25T09:30:21Z",
"modified": "2024-01-04T00:30:19Z",
"published": "2023-12-25T09:30:21Z",
"aliases": [
"CVE-2023-49226"
],
"details": "An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-25T08:15:07Z"
advisories/unreviewed/2023/12/GHSA-pc38-vvqw-jq9r/GHSA-pc38-vvqw-jq9r.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pc38-vvqw-jq9r",
"modified": "2023-12-25T09:30:21Z",
"modified": "2024-01-04T00:30:19Z",
"published": "2023-12-25T09:30:21Z",
"aliases": [
"CVE-2023-38826"
],
"details": "A Cross Site Scripting (XSS) vulnerability exists in Follet Learning Solutions Destiny through 20.0_1U. via the handlewpesearchform.do. searchString.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-25T08:15:07Z"
advisories/unreviewed/2023/12/GHSA-q565-26vc-vpx8/GHSA-q565-26vc-vpx8.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q565-26vc-vpx8",
"modified": "2023-12-25T09:30:21Z",
"modified": "2024-01-04T00:30:19Z",
"published": "2023-12-25T09:30:21Z",
"aliases": [
"CVE-2022-34268"
],
"details": "An issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects without authentication, leading to command execution on the host.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-25T08:15:07Z"
advisories/unreviewed/2024/01/GHSA-32h2-7245-4mh4/GHSA-32h2-7245-4mh4.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-32h2-7245-4mh4",
"modified": "2024-01-04T00:30:20Z",
"published": "2024-01-04T00:30:20Z",
"aliases": [
"CVE-2023-5138"
],
"details": "Glitch detection is not enabled by default for the CortexM33 core in Silicon Labs secure vault high parts EFx32xG2xB, except EFR32xG21B.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5138"
},
{
"type": "WEB",
"url": "https://community.silabs.com/069Vm0000004f6DIAQ"
},
{
"type": "WEB",
"url": "https://github.com/SiliconLabs/gecko_sdk"
}
],
"database_specific": {
"cwe_ids": [
"CWE-909"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-03T23:15:08Z"
}
}